CVE-2026-72329

CriticalCVSS 9.3/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/liquidio: drop cached VF pci_dev LUT

The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the iterator drops the previous device reference on each step. The cached pointer is then dereferenced later when handling OCTEON_VF_FLR_REQUEST.

Replace the cached VF mapping with runtime lookup on the mailbox DPI ring: derive the VF index from q_no, resolve the VF via exported PCI IOV helpers, validate it with the PF pointer and VF ID, then issue pcie_flr() and drop the reference with pci_dev_put(). Remove the unused VF lookup table initialization and cleanup.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ca6139ffc67ee6ef0459f81e37894ed411083855, < 4ec87796fadf5a631ee6513c258c0e3d9ca62f79; >= ca6139ffc67ee6ef0459f81e37894ed411083855, < e3b20de8d7c06c8f1a0ded1e52be9d282609c3da; >= ca6139ffc67ee6ef0459f81e37894ed411083855, < 1cf5c6a80adc31456f3e93b2922a2446fd63e2c4; >= ca6139ffc67ee6ef0459f81e37894ed411083855, < 08ff33dce6f91510bb296a753a232db0ca3fd3d8; >= ca6139ffc67ee6ef0459f81e37894ed411083855, < 81acef3a247fd523513a2e9f71de1c167bc0f882; >= ca6139ffc67ee6ef0459f81e37894ed411083855, < 5c0e3ba4f500fd4314ceb42f07f16bc445156431
LinuxLinux4.10

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-72336.1A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subset-cff.c of theCVE-2026-723307.5In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tls_sw_read_sock() A peer may sCVE-2026-723317.8In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix VMA access race aie2_populate_range() and amdxdna_uCVE-2026-72332In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo() amdCVE-2026-72333In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix tx ident leak for commands without a response CoCVE-2026-723348.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO_END/CONT handling Core specificationCVE-2026-723357.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci_add_adv_monitCVE-2026-72336In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: hold L2CAP conn across debugfs control get_l2cap_cCVE-2026-72337In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: avoid untracked enable work lowpan_enable_set() alCVE-2026-723387.8In the Linux kernel, the following vulnerability has been resolved: net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload There isCVE-2026-723399.8In the Linux kernel, the following vulnerability has been resolved: qede: fix off-by-one in BD ring consumption on build_skb failure qede_CVE-2026-72347.3A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts
CVE-2026-72329: Critical severity, CVSS 9.3 | Vulnix